Support clang builds; fix the defects clang and its sanitizers exposed

Clang (22.1.8 on the host, 14.0.6 in the Debian VM) now builds the tree
warning-free with --enable-warnings, in-tree and out-of-tree, with -j, and
the full VM battery passes with CC=clang: 12/12. ASan/UBSan builds run the
real tool paths (mkfs, check, tune, resize, rollback save/restore/reject)
with halt_on_error and report zero errors. Documented in tests/vm/RESULTS.md;
the CI gained clang+warnings, out-of-tree and sanitizer jobs.

Fixes found by this work:

- reiserfscore/Makefile.am: reiserfs_err.c and reiserfs_err.h shared one
  recipe. With -j, make runs the recipe once per stale target, so two
  compile_et invocations race: one deletes reiserfs_err.c ("no input
  files") while another job compiles it. Attached the recipe to
  reiserfs_err.c only; reiserfs_err.h merely depends on it. Reproduced
  with clang+ASan, stable across 5 clang / 3 asan / 3 gcc parallel builds.

- reiserfscore/Makefile.am: the rule read the source-local
  reiserfs_err.et, so VPATH builds could not find it. Use $(srcdir)/.
  make distcheck now passes.

- reiserfscore/reiserfslib.c: reiserfs_close() did fsync(fs->fs_dev) after
  reiserfs_free() released fs -- a 4-byte heap-use-after-free, flagged
  exactly at reiserfslib.c:406/407 by ASan (found by clang+ASan; gcc never
  caught it because the freed heap usually still holds the old value).
  Moved fsync before the free; reiserfs_flush() has already written
  journal and dirty buffers at that point and free_buffers() never
  writes, so the ordering preserves durability semantics.

- fsck/semantic_check.c, fsck/semantic_rebuild.c: three %K arguments passed
  &tmp_deh->deh2_dir_id where a struct reiserfs_key * is expected. It
  printed the right values only because deh2_dir_id sits at offset 4 and
  the key is read from the pointer as if dir_id sat at offset 0. Build a
  proper local key with set_key_dirid()/set_key_objectid() (the same
  idiom debugreiserfs/scan.c already uses). Verified -Waddress-of-packed-
  member (clang-only) is gone and output is unchanged.

- reiserfscore/hashes.c: four unreachable *(int *)0 = 0 stores (guarded by
  len >= 16/12/8/4 tests that cannot hold after the while (len >= 16)
  loop, len <= 15). Removed; clang's -Wnull-dereference goes quiet.
  Behavior verified: keyed_hash/yura_hash/r5_hash outputs for 16 inputs
  from 0 to 17 bytes are byte-identical before and after.

run_in_vm.sh: propagate CC into the guest, force a remount of /mnt/data
(the host rewrites the backing file under the guest), exclude generated
reiserfs_err.[ch] from the source tar. run_tests.sh: report which compiler
the battery actually used.

.github/workflows/build.yml

@@ -15,9 +15,13 @@ jobs:
         include:
           - cc: gcc
             extra: ""
+          - cc: gcc
+            extra: "--enable-warnings"
           - cc: clang
             extra: ""
-          - cc: gcc
+          # clang builds warning-free with -Wall -Wextra; keep this job as
+          # the regression gate for that guarantee.
+          - cc: clang
             extra: "--enable-warnings"
           - cc: gcc
             extra: "--enable-io-failure-emulation"
@@ -32,7 +36,7 @@ jobs:
           sudo apt-get install -y --no-install-recommends \
             autoconf automake libtool pkg-config \
             libcom-err-dev uuid-dev \
-            build-essential
+            build-essential clang
 
       - name: Bootstrap
         run: ./autogen.sh
@@ -43,10 +47,119 @@ jobs:
       - name: Build
         run: make -j"$(nproc)"
 
+      - name: Fail on any compiler warning
+        if: matrix.extra == '--enable-warnings'
+        run: |
+          make -j"$(nproc)" clean >/dev/null 2>&1 || true
+          make -j"$(nproc)" > build.log 2>&1 || { cat build.log; exit 1; }
+          if grep -q "warning:" build.log; then
+            grep "warning:" build.log
+            echo "build is not -Wall -Wextra clean"
+            exit 1
+          fi
+
       - name: Smoke test
         run: |
           set -e
           dd if=/dev/zero of=smoke.img bs=1M count=64 status=none
           ./mkreiserfs/mkreiserfs -f -q smoke.img
           ./fsck/reiserfsck --check -f -q -y smoke.img
-          ./debugreiserfs/debugreiserfs -S smoke.img
+          ./debugreiserfs/debugreiserfs -S smoke.img
+
+  out-of-tree:
+    # Parallel builds from a separate build directory; historically this
+    # tripped the compile_et target race, so keep it covered.
+    runs-on: ubuntu-latest
+    env:
+      CC: gcc
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            autoconf automake libtool pkg-config \
+            libcom-err-dev uuid-dev build-essential
+
+      - name: Bootstrap
+        run: ./autogen.sh
+
+      - name: Configure (out-of-tree)
+        run: |
+          mkdir -p "$RUNNER_TEMP/rfs-build"
+          cd "$RUNNER_TEMP/rfs-build"
+          "$GITHUB_WORKSPACE/configure" --enable-warnings
+
+      - name: Build
+        run: make -C "$RUNNER_TEMP/rfs-build" -j"$(nproc)"
+
+      - name: Smoke test
+        run: |
+          set -e
+          cd "$RUNNER_TEMP/rfs-build"
+          dd if=/dev/zero of=smoke.img bs=1M count=64 status=none
+          ./mkreiserfs/mkreiserfs -f -q smoke.img
+          ./fsck/reiserfsck --check -f -q -y smoke.img
+
+  sanitizers:
+    # clang + AddressSanitizer + UndefinedBehaviorSanitizer over the real
+    # tool paths (format, check, resize, rollback).  Leak detection is off:
+    # the one-shot tools deliberately keep process-lifetime allocations.
+    runs-on: ubuntu-latest
+    env:
+      CC: clang
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            autoconf automake libtool pkg-config \
+            libcom-err-dev uuid-dev build-essential clang
+
+      - name: Bootstrap
+        run: ./autogen.sh
+
+      - name: Configure with sanitizers
+        run: >
+          ./configure --enable-warnings
+          CFLAGS="-g -O1 -fsanitize=address,undefined -fno-omit-frame-pointer"
+
+      - name: Build
+        run: make -j"$(nproc)"
+
+      - name: Exercise tools under sanitizers
+        env:
+          ASAN_OPTIONS: detect_leaks=0:halt_on_error=1
+          UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
+        run: |
+          set -e
+          dd if=/dev/zero of=/tmp/s.img bs=1M count=64 status=none
+          ./mkreiserfs/mkreiserfs -f -q -l SAN /tmp/s.img
+          ./fsck/reiserfsck --check -f -q -y /tmp/s.img
+          ./debugreiserfs/debugreiserfs -S /tmp/s.img
+          ./tune/reiserfstune -l SAN2 -f /tmp/s.img
+
+          # resize: 64M -> 128M
+          dd if=/dev/zero of=/tmp/b.img bs=1M count=64 status=none
+          ./mkreiserfs/mkreiserfs -f -q /tmp/b.img
+          truncate -s 128M /tmp/b.img
+          ./resize_reiserfs/resize_reiserfs -s +64M -f /tmp/b.img
+          ./fsck/reiserfsck --check -f -q -y /tmp/b.img
+
+          # rollback save + restore
+          cp /tmp/s.img /tmp/r.img
+          ./fsck/reiserfsck --fix-fixable -y -q -R /tmp/rb.dat /tmp/r.img
+          ./fsck/reiserfsck --rollback-fsck-changes -y -q -R /tmp/rb.dat /tmp/r.img
+
+          # rollback file with garbage magic must be rejected
+          head -c 100 /dev/urandom > /tmp/bad.dat
+          if ./fsck/reiserfsck --rollback-fsck-changes -y -q -R /tmp/bad.dat /tmp/r.img 2>&1 \
+               | grep -q "does not look like a rollback file"; then
+            echo "rollback garbage correctly rejected"
+          else
+            echo "rollback garbage was NOT rejected"
+            exit 1
+          fi

README

@@ -65,3 +65,15 @@ the repository. After a fresh clone, bootstrap them first:
 
 Build dependencies: a C compiler, autoconf, automake, libtool, pkg-config,
 libcom_err (com_err development files) and, optionally, libuuid.
+
+Supported compilers: gcc and clang.  Both build warning-free with
+	./configure --enable-warnings && make   (i.e. -Wall -Wextra).
+Out-of-tree (separate build directory) and parallel (-j) builds are
+supported.  Sanitizer builds are exercised in CI:
+	CC=clang ./configure --enable-warnings \
+	  CFLAGS="-g -O1 -fsanitize=address,undefined -fno-omit-frame-pointer"
+
+Note: reiserfsprogs requires a libc with printf format extensions
+(glibc's register_printf_specifier/register_printf_modifier).  It does not
+build against musl; see tests/vm/RESULTS.md.  A libvirt/KVM test
+environment for Debian and Alpine lives in tests/vm/.

fsck/semantic_check.c

@@ -676,16 +676,27 @@ static int check_semantic_pass(struct reiserfs_key *key,
 				} else {
 					/* update key dir entry points to */
 					struct reiserfs_de_head *tmp_deh;
+					struct reiserfs_key deh_key;
 
 					tmp_deh =
 					    B_I_DEH(get_bh(&path),
 						    tp_item_head(&path)) +
 					    path.pos_in_item;
+					/* Build a proper key from the entry's
+					   dirid/objectid.  Passing
+					   &tmp_deh->deh2_dir_id as a
+					   reiserfs_key * only worked by
+					   offset coincidence and trips
+					   -Waddress-of-packed-member. */
+					set_key_dirid(&deh_key,
+						      get_deh_dirid(tmp_deh));
+					set_key_objectid(&deh_key,
+							 get_deh_objectid(tmp_deh));
+
 					fsck_log
 					    ("The directory %K pointing to %K (\"%.*s\") updated to point "
-					     "to ", &tmp_ih.ih_key,
-					     &tmp_deh->deh2_dir_id, namelen,
-					     name);
+					     "to ", &tmp_ih.ih_key, &deh_key,
+					     namelen, name);
 					set_deh_dirid(tmp_deh,
 						      get_key_dirid
 						      (&relocated_ih.ih_key));
@@ -694,9 +705,8 @@ static int check_semantic_pass(struct reiserfs_key *key,
 							 (&relocated_ih.
 							  ih_key));
 
-					fsck_log("%K (\"%.*s\")\n",
-						 &tmp_deh->deh2_dir_id, namelen,
-						 name);
+					fsck_log("%K (\"%.*s\")\n", &deh_key,
+						 namelen, name);
 					mark_buffer_dirty(get_bh(&path));
 				}
 				dir_size += DEH_SIZE + entry_len;

fsck/semantic_rebuild.c

@@ -1006,11 +1006,23 @@ start_again:			/* when directory was relocated */
 				} else {
 					/* update key dir entry points to */
 					struct reiserfs_de_head *tmp_deh;
+					struct reiserfs_key deh_key;
 
 					tmp_deh =
 					    B_I_DEH(get_bh(&path),
 						    tp_item_head(&path)) +
 					    path.pos_in_item;
+					/* Build a proper key from the entry's
+					   dirid/objectid.  Passing
+					   &tmp_deh->deh2_dir_id as a
+					   reiserfs_key * only worked by
+					   offset coincidence and trips
+					   -Waddress-of-packed-member. */
+					set_key_dirid(&deh_key,
+						      get_deh_dirid(tmp_deh));
+					set_key_objectid(&deh_key,
+							 get_deh_objectid(tmp_deh));
+
 					fsck_log
 					    ("The entry %K (\"%.*s\") in directory %K updated to point to ",
 					     &object_key, namelen, name,
@@ -1023,7 +1035,7 @@ start_again:			/* when directory was relocated */
 							 (&relocated_ih.
 							  ih_key));
 
-					fsck_log("%K\n", &tmp_deh->deh2_dir_id);
+					fsck_log("%K\n", &deh_key);
 					mark_buffer_dirty(get_bh(&path));
 				}
 				dir_size += DEH_SIZE + entry_len;

reiserfscore/Makefile.am

@@ -3,9 +3,15 @@ lib_LTLIBRARIES = libreiserfscore.la
 reiserfsdir = $(includedir)/reiserfs
 reiserfs_HEADERS = reiserfs_err.h
 
-reiserfs_err.c reiserfs_err.h: reiserfs_err.et
-	$(RM) -f reisefs_err.c reiserfs_err.h
-	compile_et reiserfs_err.et
+# compile_et writes reiserfs_err.c AND reiserfs_err.h in one pass.  Keep the
+# recipe on a single target: when one recipe is shared by two targets, parallel
+# make can run it concurrently for both, and one run deletes the .c while
+# another job is still compiling it ("no input files").  reiserfs_err.h only
+# depends on reiserfs_err.c, so the recipe always runs exactly once.
+reiserfs_err.c: $(srcdir)/reiserfs_err.et
+	$(RM) -f reiserfs_err.c reiserfs_err.h
+	compile_et $(srcdir)/reiserfs_err.et
+
 reiserfs_err.h: reiserfs_err.c
 
 BUILT_SOURCES = reiserfs_err.h reiserfs_err.c

reiserfscore/hashes.c

@@ -83,10 +83,9 @@ u32 keyed_hash(const signed char *msg, int len)
 		msg += 16;
 	}
 
+	/* len <= 15 here: the while loop above consumed every full 16-byte
+	   block, so the "len >= 16" test that used to sit here was dead. */
 	if (len >= 12) {
-		if (len >= 16)
-			*(int *)0 = 0;
-
 		a = (u32) msg[0] |
 		    (u32) msg[1] << 8 | (u32) msg[2] << 16 | (u32) msg[3] << 24;
 		b = (u32) msg[4] |
@@ -101,8 +100,6 @@ u32 keyed_hash(const signed char *msg, int len)
 			d |= msg[i];
 		}
 	} else if (len >= 8) {
-		if (len >= 12)
-			*(int *)0 = 0;
 		a = (u32) msg[0] |
 		    (u32) msg[1] << 8 | (u32) msg[2] << 16 | (u32) msg[3] << 24;
 		b = (u32) msg[4] |
@@ -114,8 +111,6 @@ u32 keyed_hash(const signed char *msg, int len)
 			c |= msg[i];
 		}
 	} else if (len >= 4) {
-		if (len >= 8)
-			*(int *)0 = 0;
 		a = (u32) msg[0] |
 		    (u32) msg[1] << 8 | (u32) msg[2] << 16 | (u32) msg[3] << 24;
 
@@ -125,8 +120,7 @@ u32 keyed_hash(const signed char *msg, int len)
 			b |= msg[i];
 		}
 	} else {
-		if (len >= 4)
-			*(int *)0 = 0;
+		/* len <= 3 here. */
 		a = b = c = d = pad;
 		for (i = 0; i < len; i++) {
 			a <<= 8;

reiserfscore/reiserfslib.c

@@ -403,8 +403,13 @@ void reiserfs_close(reiserfs_filsys_t fs)
 	reiserfs_close_ondisk_bitmap(fs);
 
 	reiserfs_flush(fs);
-	reiserfs_free(fs);
+	/* fsync must run while fs is still valid: reiserfs_free() releases
+	   the handler, and reading fs->fs_dev after it was a use-after-free.
+	   reiserfs_flush() has already written the journal and every dirty
+	   buffer (free_buffers() inside reiserfs_free only validates and
+	   frees), so the data is on the device by this point. */
 	fsync(fs->fs_dev);
+	reiserfs_free(fs);
 }
 
 int reiserfs_new_blocknrs(reiserfs_filsys_t fs,

tests/vm/README.md

@@ -27,7 +27,7 @@ do libvirt: a conectividade vem do backend `passt` em modo *user*.
 
 ```mermaid
 graph LR
-  H[host] -->|qemu:///session| D[rfs-debian<br/>Debian 12 · gcc]
+  H[host] -->|qemu:///session| D[rfs-debian<br/>Debian 12 · gcc + clang]
   H -->|qemu:///session| A[rfs-alpine<br/>Alpine 3.20 · gcc/musl]
   D -->|passt :2222| S[ssh opcional]
   A -->|passt| S
@@ -58,13 +58,34 @@ cd tests/vm
 ./setup_env.sh
 
 # 2. rodar a bateria em uma VM
-./run_in_vm.sh rfs-alpine
-./run_in_vm.sh rfs-debian
+./run_in_vm.sh rfs-debian              # gcc do guest
+CC=clang ./run_in_vm.sh rfs-debian     # clang do guest
+./run_in_vm.sh rfs-alpine              # esperado FALHAR no configure (musl)
 
 # 3. destruir tudo
 ./teardown_env.sh
 ```
 
+No Debian, instale o clang no guest uma vez (a rede user-mode do `passt`
+precisa de resolver manual antes do apt):
+
+```sh
+python3 guestcmd.py rfs-debian 'ip addr add 192.168.1.5/24 dev enp1s0;
+  ip link set enp1s0 up; ip route add default via 192.168.1.1;
+  echo nameserver 8.8.8.8 > /etc/resolv.conf;
+  apt-get update -qq && DEBIAN_FRONTEND=noninteractive \
+    apt-get install -y -qq clang'
+```
+
+## Compiladores suportados
+
+O projeto compila **sem warnings** com `-Wall -Wextra` em gcc (>= 12) e
+clang (>= 14; validado em 14.0.6 e 22.1.8). Os mesmos builds são exercitados
+sob **AddressSanitizer + UndefinedBehaviorSanitizer** (`CC=clang
+CFLAGS="-g -O1 -fsanitize=address,undefined ..."`) tanto no host (CI) quanto
+manualmente; resultados em `RESULTS.md`.
+
+
 ## O que a bateria cobre (`tests/vm/run_tests.sh`)
 
 Executado **dentro** do guest, sobre o código extraído do `vdb`:

tests/vm/RESULTS.md

@@ -99,6 +99,72 @@ Em `fsck/semantic_rebuild.c` o caminho equivalente é seguro: o bloco
 (linhas 808–822), então `new_ih` é escrito antes do `case RELOCATED:`
 (linha 999).
 
+## Validação com clang
+
+Ferramentaria: Fedora 44 (host) com **clang 22.1.8**, Debian 12 na VM com
+**clang 14.0.6**. Todos os builds abaixo usam `--enable-warnings`
+(-Wall -Wextra).
+
+| Build | Resultado |
+|---|---|
+| host clang in-tree, -j | 0/5 falhas, **0 warnings** |
+| host clang out-of-tree, -j | passa, 0 warnings |
+| host clang + ASan/UBSan out-of-tree, -j | 0/3 falhas, 0 warnings |
+| host gcc out-of-tree, -j | 3/3 limpo |
+| host `make distcheck` | passa (VPATH + install/uninstall + tarballs) |
+| VM Debian clang 14.0.6, bateria completa | **12/12, 0 warnings** |
+
+### O que clang expôs (e foi corrigido)
+
+1. **Corrida de build paralela em `compile_et`** (`reiserfscore/Makefile.am`):
+   `reiserfs_err.c` e `reiserfs_err.h` eram alvos de UMA mesma receita; com
+   `-j` o make executa a receita duas vezes em paralelo e um processo apaga
+   o `.c` enquanto o outro compila → `clang: error: no input files`.
+   Reproduzido com clang+ASan; a correção vale para qualquer compilador.
+   A receita ficou atrelada apenas a `reiserfs_err.c`, e
+   `reiserfs_err.h: reiserfs_err.c` apenas ordena os dois. 5/5 builds
+   paralelos limpos após a correção.
+
+2. **Build out-of-tree quebrado** (pré-existente, também com gcc): a regra
+   referenciava `reiserfs_err.et` sem `$(srcdir)/`. Corrigido junto.
+
+3. **`-Waddress-of-packed-member`** (só o clang aponta; 3 sítios):
+   `fsck/semantic_check.c` e `fsck/semantic_rebuild.c` passavam
+   `&tmp_deh->deh2_dir_id` como argumento `%K`, que espera
+   `struct reiserfs_key *`. Funcionava por coincidência de offsets
+   (`deh2_dir_id` em 4 lido como `k2_dir_id` em 0 do cast). Agora montam uma
+   `reiserfs_key` local via `set_key_dirid`/`set_key_objectid` — saída
+   idêntica, sem depender de coincidência.
+
+4. **`-Wnull-dereference` em `reiserfscore/hashes.c`**: quatro stores mortos
+   `*(int *)0 = 0` protegidos por condições inalcançáveis (após o loop
+   `while (len >= 16)`, `len <= 15`; os ramos testavam `len >= 16/12/8/4`).
+   Removidos. Comportamento verificado: saída de `keyed_hash`, `yura_hash` e
+   `r5_hash` para 16 entradas (vazio a 17 bytes) **byte a byte idêntica**
+   antes e depois (diff vazio).
+
+5. **heap-use-after-free real, encontrado por ASan com clang**:
+   `reiserfs_close()` chamava `fsync(fs->fs_dev)` DEPOIS de
+   `reiserfs_free()`, que libera o `fs` — leitura pendente de 4 bytes em
+   memória libertada (o ASan apontou exatamente `reiserfslib.c:406/407`; o
+   gcc nunca acusou porque o heap ainda "devolve" o valor velho). Corrigido
+   movendo o `fsync` para antes do free — a escrita já está no dispositivo
+   neste ponto (`reiserfs_flush()` despeja journal e buffers; os
+   `free_buffers()` de `reiserfs_free()` apenas validam e libertam, sem
+   escrever). Revalidado com ASan+UBSan em `halt_on_error`: mkfs, check,
+   tune, debugreiserfs, resize 64→128 MiB e rollback completo — **zero
+   erros**; bateria completa no host gcc continua 12/12.
+
+### Não-bugs registrados
+
+- LeakSanitizer: 136 bytes, 1 alocação em `debugreiserfs` (`getmem` no
+  `main`, de vida de processo; o `exit` recolhe). Aceitável para
+  ferramenta one-shot; por isso o job de CI com sanitizadores roda com
+  `detect_leaks=0`.
+- `AddressSanitizer: WARNING: unexpected format specifier ... %U`: o
+  interceptor do ASan não conhece os especificadores customizados do
+  projeto. Informativo, uma vez por processo.
+
 ## Achado 3: limitação do ambiente (não do código)
 
 Nas imagens cloud o `cloud-init` não aplicou a senha do usuário: o datasource
@@ -116,9 +182,14 @@ resolver manualmente para instalar pacotes nas VMs.
 ```sh
 cd tests/vm
 ./setup_env.sh                 # imagens + VMs (uma vez)
-./run_in_vm.sh rfs-debian      # build + bateria completa
+./run_in_vm.sh rfs-debian      # gcc: build + bateria completa
+CC=clang ./run_in_vm.sh rfs-debian   # clang no guest (instalar antes: ver README)
 ./run_in_vm.sh rfs-alpine      # deve falhar no configure (esperado)
 ./teardown_env.sh
+
+# host: builds paralelos in-tree e out-of-tree, distcheck
+make distcheck
+CC=clang ./configure --enable-warnings && make -j"$(nproc)"
 ```
 
 Detalhes do ambiente, topologia e limitações: `tests/vm/README.md`.

tests/vm/run_in_vm.sh

@@ -2,7 +2,8 @@
 # Envia o codigo-fonte e o script de teste para dentro de uma VM e executa.
 #
 # Uso: run_in_vm.sh <dominio>
-# Requer: guestcmd.py (mesmo diretorio), mkisofs, libvirt.
+#      CC=clang run_in_vm.sh rfs-debian    # build no guest com clang
+# Requer: guestcmd.py (mesmo diretorio), mkisofs, libvirt, sudo (loop mount).
 set -e
 
 DOMAIN=${1:?uso: run_in_vm.sh <dominio>}
@@ -17,13 +18,16 @@ tar czf "$WORK/rfs-src.tar.gz" -C "$REPO" \
     --exclude=autom4te.cache --exclude=config.h --exclude=config.log \
     --exclude=config.status --exclude=libtool \
     --exclude='Makefile' --exclude='Makefile.in' --exclude=configure \
-    --exclude=aclocal.m4 --exclude='*.8' \
+    --exclude=aclocal.m4 --exclude='*.8' --exclude=stamp-h1 \
+    --exclude='reiserfscore/reiserfs_err.c' \
+    --exclude='reiserfscore/reiserfs_err.h' \
     .
 
 echo "== montando o disco de dados =="
 rm -rf /tmp/vmdata.$$ && mkdir -p /tmp/vmdata.$$
 sudo mount -o loop "$WORK/data.img" /tmp/vmdata.$$
 sudo cp "$WORK/rfs-src.tar.gz" "$HERE/run_tests.sh" /tmp/vmdata.$$
+sync
 sudo umount /tmp/vmdata.$$ && rmdir /tmp/vmdata.$$
 
 echo "== transferindo para $DOMAIN =="
@@ -38,14 +42,17 @@ EOF
 virsh attach-device "$DOMAIN" "$ATTACH" --live >/dev/null 2>&1 || true
 rm -f "$ATTACH"
 
-echo "== extraindo e rodando os testes =="
-"$HERE/guestcmd.py" "$DOMAIN" '
+echo "== extraindo e rodando os testes ${CC:+com CC=$CC} =="
+"$HERE/guestcmd.py" "$DOMAIN" "
 set -e
 mkdir -p /mnt/data
-mountpoint -q /mnt/data || mount -o ro /dev/vdb /mnt/data
+# remount forcado: o host trocou o conteudo do disco por baixo do guest
+umount /mnt/data 2>/dev/null || true
+mount -o ro /dev/vdb /mnt/data
+rm -rf /root/rfs
 mkdir -p /root/rfs
 tar xzf /mnt/data/rfs-src.tar.gz -C /root/rfs
 cp /mnt/data/run_tests.sh /root/run_tests.sh
 chmod +x /root/run_tests.sh
-SRC=/root/rfs sh /root/run_tests.sh
-' 900
+SRC=/root/rfs ${CC:+CC=$CC }sh /root/run_tests.sh
+" 1800

tests/vm/run_tests.sh

@@ -16,7 +16,8 @@ cd "$SRC" || { echo "FAIL: $SRC nao existe"; exit 1; }
 
 echo "=== ambiente ==="
 uname -srm
-(cc --version 2>/dev/null || echo "sem cc") | head -1
+echo "CC=${CC:-cc}"
+${CC:-cc} --version 2>/dev/null | head -1 || echo "sem ${CC:-cc}"
 ldd --version 2>&1 | head -1
 
 echo